Privacy Policy
This policy explains what personal data Cooling.Center collects, why, how long we keep it, and how you can exercise your rights under the EU General Data Protection Regulation (GDPR).
Who we are
Cooling.Center is an open citizen project mapping public heat refuges, wildfires and air quality worldwide. The data controller for this website is:
- Data controller: Cooling.Center
- Contact: privacy@cooling.center
What we collect
Cooling.Center has no user accounts. We only process personal data in these situations:
- Purchases (Shop / Advertise): Email, billing address and payment details you enter at Stripe checkout are stored by Stripe. On our side we keep the Stripe session id, amount, product code, and — for ads — the company name, message and target URL you chose to publish.
- Cookie consent log: When you make a choice on the cookie banner we store the categories you approved, a truncated hash of your IP (not the IP itself), user-agent and a timestamp — as GDPR requires we be able to demonstrate proof of consent.
- Browser storage on your device: Your language, dark-mode, selected city, layer preferences and "intro-video seen" flag live only in your browser localStorage / sessionStorage. They never reach our servers.
- Server logs: Standard web-server access logs (IP, path, user-agent) rotate every 14 days for abuse and debugging.
Legal basis (Art. 6 GDPR)
- Contract: Processing purchases and delivering ads you paid for.
- Consent: Non-essential cookies (preferences, analytics, marketing beyond checkout).
- Legitimate interest: Security logs, fraud prevention, aggregate stats.
How long we keep it
| Data | Retention |
|---|---|
| Stripe order records (email in metadata, amount, invoice) | 10 years (EU accounting law) |
| Live ad content (company, message, target URL) | Until the ad expires + 30 days, then deleted |
| Cookie consent log | 13 months (CNIL guideline) |
| Server access logs | 14 days rolling |
Your rights
Under GDPR you can, at any time and free of charge:
- Access — request a copy of every piece of data we hold about you.
- Rectification — ask us to correct inaccurate data.
- Erasure (right to be forgotten) — ask us to delete your data, subject to legal retention.
- Restriction — ask us to freeze processing while a dispute is resolved.
- Portability — receive your data in a machine-readable JSON format.
- Objection — object to processing based on legitimate interest.
- Withdraw consent — revoke a consent you previously gave.
The fastest way is our self-serve form: Submit a data-subject request.
Who we share data with
We never sell your data. We only share what is strictly needed with the following processors:
- Stripe — handles payments, tax calculation and receipts. See stripe.com/privacy.
- NASA FIRMS / WAQI / RainViewer / OpenStreetMap / Météo France / Open-Meteo — map tile and open-data providers — we only forward map viewport coordinates, never personal data.
- Hosting — our infrastructure runs on cloud servers located in the EU. Standard operational access only.
International transfers
Stripe may process a small subset of data in the United States under Standard Contractual Clauses (SCCs). No other transfers outside the EU/EEA are performed.
Security
TLS on every connection, hashed IPs in consent logs, principle-of-least-privilege access to the database, encrypted backups.
Children
Cooling.Center is not directed at children under 15 and does not knowingly collect their data.
Changes to this policy
We will update this page — and the date at the top — whenever we change how we process personal data. Material changes will re-prompt the cookie banner.
Complaint
If you believe we mishandled your data, you have the right to lodge a complaint with the CNIL (French supervisory authority) or your local EU data-protection authority.